First, create a certificate signing request. The command below will simultaneously generate a new RSA-encrypted private key, privkey.pem:
...
> <JAVA_HOME_DIR>/bin/keytool -changealias -alias 1 -destalias mykey -keystore my_confluence_domain.jks
Import the root certificate of your CA into the Java keystore.
> <JAVA_HOME_DIR>/bin/keytool -keystore my_confluence_domain.jks -import -alias root -file /apps/confluence/jre/lib/security/root.cer
...